ExpSaAllocatorAllocate
INT64 __fastcall ExpSaAllocatorAllocate(UINT64 P2, UINT64 a2){
unsigned int v3;
char v4;
_ETHREAD *CurrentThread;
INT64 Memory;
__int64 v7;
unsigned int v8;
char v9;
__int64 v10;
int SessionId;
bool v12;
UINT64 v13;
INT64 v14;
_ETHREAD *v16;
char v17;
int v18;
__int64 v19;
unsigned __int64 v20;
__int64 v21;
INT64 v22;
CHAR *v23;
CHAR *v24;
INT64 v25;
__int64 v26;
_ETHREAD *v27;
unsigned __int8 v28;
__int64 v29;
__int64 v30;
int v31;
CHAR **v32;
unsigned int v33;
int v34;
unsigned int v35[5];
unsigned int v36;
int v37;
v36 = a2;
v3 = a2;
v33 = 0;
v4 = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
Memory = -1i64;
--*((_WORD *)CurrentThread + 243);
if( ++*((_BYTE *)CurrentThread + 794) != 1 )
KeBugCheckEx(0x192u, (ULONG_PTR)CurrentThread, P2, KeGetCurrentIrql(), 0i64);
LOBYTE(v7) = *((_BYTE *)CurrentThread + 792);
v8 = -1;
if( !(_BYTE)v7 )
{
if( !*((_BYTE *)CurrentThread + 870) )
{
v10 = 0i64;
goto LABEL_46;
}
v7 = *((unsigned __int8 *)CurrentThread + 870);
*((_BYTE *)CurrentThread + 870) = 0;
LOBYTE(v7) = *((_BYTE *)CurrentThread + 792) | v7;
}
v9 = v7;
_BitScanForward((unsigned int *)&v7, (unsigned __int8)v7);
*((_BYTE *)CurrentThread + 792) = v9 & ~(1 << v7);
v10 = *((_QWORD *)CurrentThread + 100) + 96 * v7;
if( v10 )
{
if( P2 >= 0xFFFF800000000000ui64 && MiState[((P2 >> 39) & 0x1FF) + 12296] == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)CurrentThread + 23));
else
SessionId = -1;
*(_DWORD *)(v10 + 40) = SessionId;
*(_QWORD *)(v10 + 32) = P2 & 0x7FFFFFFFFFFFFFFCi64;
goto LABEL_8;
}
LABEL_46:
_interlockedbittestandset((volatile signed __int32 *)CurrentThread + 30, 0x10u);
LABEL_8:
--*((_BYTE *)CurrentThread + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, P2, &v33);
v12 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
if( v12 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
KiCheckForKernelApcDelivery();
if( _InterlockedCompareExchange64((volatile signed __int64 *)P2, 17i64, 0i64) )
ExfAcquirePushLockSharedEx((UINT64 *)P2, (VOID *)v10, (VOID *)P2);
if( v10 )
*(_BYTE *)(v10 + 26) |= 1u;
v13 = P2 + 8;
v14 = *(_QWORD *)(P2 + 8);
while( 1 )
{
if( v14 != v13 )
{
while( 1 )
{
Memory = ExpSaPageGroupAllocateMemory(v14, v3);
if( Memory != -1 )
break;
v14 = *(_QWORD *)v14;
if( v14 == v13 )
goto LABEL_48;
}
if( !*(_DWORD *)(v14 + 36) )
_InterlockedOr((volatile signed __int32 *)(P2 + 64), 2u);
goto LABEL_20;
}
LABEL_48:
v22 = *(_QWORD *)v13;
if( !v4 && _InterlockedCompareExchange64((volatile signed __int64 *)P2, 1i64, 17i64) != 17 )
{
v26 = 0i64;
if( _InterlockedCompareExchange64((volatile signed __int64 *)P2, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)P2);
KeAbPostRelease((PVOID)P2);
v35[0] = 0;
v27 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v27 + 243);
if( ++*((_BYTE *)v27 + 794) != 1 )
KeBugCheckEx(0x192u, (ULONG_PTR)v27, P2, KeGetCurrentIrql(), 0i64);
v28 = *((_BYTE *)v27 + 792);
v34 = 0;
if( !v28 )
{
if( !*((_BYTE *)v27 + 870) )
goto LABEL_72;
v29 = *((unsigned __int8 *)v27 + 870);
*((_BYTE *)v27 + 870) = 0;
v28 = v29 | *((_BYTE *)v27 + 792);
}
_BitScanForward((unsigned int *)&v30, v28);
v34 = v30;
*((_BYTE *)v27 + 792) = v28 & ~(1 << v30);
v26 = *((_QWORD *)v27 + 100) + 96 * v30;
if( v26 )
{
if( P2 >= 0xFFFF800000000000ui64 && MiState[((P2 >> 39) & 0x1FF) + 12296] == 1 )
v31 = MmGetSessionIdEx(*((_QWORD *)v27 + 23));
else
v31 = -1;
*(_DWORD *)(v26 + 40) = v31;
*(_QWORD *)(v26 + 32) = P2 & 0x7FFFFFFFFFFFFFFCi64;
goto LABEL_75;
}
LABEL_72:
_interlockedbittestandset((volatile signed __int32 *)v27 + 30, 0x10u);
LABEL_75:
--*((_BYTE *)v27 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v27, P2, v35);
v12 = (*((_WORD *)v27 + 243))++ == 0xFFFF;
if( v12 && *((_ETHREAD **)v27 + 19) != (_ETHREAD *)((char *)v27 + 152) )
KiCheckForKernelApcDelivery();
if( _interlockedbittestandset64((volatile signed __int32 *)P2, 0i64) )
ExfAcquirePushLockExclusiveEx((UINT64 *)P2, (VOID *)v26, (VOID *)P2);
if( v26 )
*(_BYTE *)(v26 + 26) |= 1u;
}
v14 = *(_QWORD *)v13;
v4 = 1;
if( v22 == *(_QWORD *)v13 )
break;
v3 = v36;
}
v23 = ExpSaPageGroupDescriptorAllocate(P2, *(_DWORD *)(P2 + 64) & 1);
v24 = v23;
if( v23 )
{
Memory = ExpSaPageGroupAllocateMemory((INT64)v23, v36);
if( *((_DWORD *)v24 + 9) )
{
*((_DWORD *)v24 + 10) = 0;
v25 = *(_QWORD *)v13;
if( *(_QWORD *)(*(_QWORD *)v13 + 8i64) == v13 )
{
*(_QWORD *)v24 = v25;
*((_QWORD *)v24 + 1) = v13;
*(_QWORD *)(v25 + 8) = v24;
*(_QWORD *)v13 = v24;
goto LABEL_20;
}
LABEL_86:
__fastfail(3u);
}
*((_DWORD *)v24 + 10) = 1;
v32 = *(CHAR ***)(P2 + 32);
if( *v32 != (CHAR *)(P2 + 24) )
goto LABEL_86;
*(_QWORD *)v24 = P2 + 24;
*((_QWORD *)v24 + 1) = v32;
*v32 = v24;
*(_QWORD *)(P2 + 32) = v24;
LABEL_20:
if( (*(_DWORD *)(P2 + 64) & 2) != 0 )
{
if( v4 || _InterlockedCompareExchange64((volatile signed __int64 *)P2, 1i64, 17i64) == 17 )
{
v4 = 1;
ExpSaAllocatorOptimizeList(P2);
goto LABEL_21;
}
LABEL_22:
if( _InterlockedCompareExchange64((volatile signed __int64 *)P2, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)P2);
KeAbPostRelease((PVOID)P2);
return Memory;
}
LABEL_21:
if( !v4 )
goto LABEL_22;
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)P2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)P2);
v37 = 0;
v16 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType(P2) == 1 )
v8 = MmGetSessionIdEx(*((_QWORD *)v16 + 23));
--*((_WORD *)v16 + 243);
v17 = ++*((_BYTE *)v16 + 794);
v18 = (*((char *)v16 + 792) | *((char *)v16 + 870)) ^ 0x3F;
while( 1 )
{
v12 = !_BitScanReverse((unsigned int *)&v19, v18);
if( v12 )
break;
v20 = *((_QWORD *)v16 + 100) + 96 * v19;
v18 &= ~(1 << v19);
if( (*(_BYTE *)(v20 + 26) & 1) != 0
&& (*(_DWORD *)(v20 + 32) & 1) == 0
&& (*(_QWORD *)(v20 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (P2 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v20 + 40) == v8 )
{
*(_BYTE *)(v20 + 26) &= ~1u;
if( *(_QWORD *)(v20 + 32) )
{
if( v20 )
{
*(_BYTE *)(v20 + 32) |= 2u;
if( *(__int64 *)(v20 + 32) < 0 )
KiAbEntryRemoveFromTree(v20);
v37 = *(_DWORD *)(v20 + 88) & 0x1FFFF;
*(_DWORD *)(v20 + 88) &= 0xFFFE0000;
*(_BYTE *)(v20 + 25) &= ~1u;
*(_QWORD *)(v20 + 32) = 0i64;
v21 = (__int64)(v20 - *((_QWORD *)v16 + 100)) / 96;
if( v17 == 1 )
*((_BYTE *)v16 + 792) |= 1 << v21;
else
_InterlockedOr8((volatile signed __int8 *)v16 + 870, 1 << v21);
goto LABEL_43;
}
break;
}
}
}
if( (*((_DWORD *)v16 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v16, P2, v8, 0i64);
LABEL_43:
--*((_BYTE *)v16 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v16, P2, (unsigned int *)&v37);
v12 = (*((_WORD *)v16 + 243))++ == 0xFFFF;
if( v12 && *((_ETHREAD **)v16 + 19) != (_ETHREAD *)((char *)v16 + 152) )
KiCheckForKernelApcDelivery();
return Memory;
}Referenced by:
ExSaAllocate